DigiCert: passports and licenses left online

DigiCert, the certificate authority, told customers that a server migration left an internal business system on the public internet. The system had been limited to a VPN. The move was in February 2025. DigiCert says the archive on that system is a small slice of older customer records: names, business email addresses, phone numbers, and business addresses. Where a customer had sent a document to prove identity, the same records can include a driver’s license, a passport, a utility bill, or another paper that shows a name and an address.

Notices have started to go out. Cloud architect Fabian Bader posted one he received. DigiCert says it is still reading the identification files to decide who else gets that letter, and that those customers will hear when the review is done. How many people are in the set is not in the public notice.

A registration page, then a late realization

An incident report on Mozilla’s Bugzilla traces the exposure to that February 2025 migration. The system that became reachable carried a self-registration page meant for other applications. People outside DigiCert could create accounts. Those accounts were not attached to any one product. An authorization flaw still let them open the archived customer records. DigiCert says the access was read-only: the account could not change records, approve a validation, or issue a certificate.

DigiCert found unauthorized accounts on the system in June 2026. The first reading was that those accounts could not see customer data, because they were not assigned to an application. A later report, through the company’s managed security research program, warned that outsiders could still create accounts there. DigiCert restricted the system and fixed the authorization bug. It did not yet know the archive had already been read.

On October 19, 2026, a further look found that an unauthorized account had opened customer information between June 27 and July 2, 2026. DigiCert has said the June finding was handled as stray account creation. The question of whether those accounts had already read the archive waited until October. The company now says access to the system is restricted, self-registration is off, and further access controls are in place.

DigiCert says its certificate authority services, CertCentral, and the DigiCert ONE platform were outside this compromise. On the company’s account, customer login passwords and certificates that were already issued are still intact. The loss is the archive: contact data, and for some customers the scan of an identity document uploaded so a certificate could be approved.

What certificate customers should do

If you have sent DigiCert a passport, a license, or a utility bill for validation, treat that document as exposed until the review says your file was outside the accessed set. The read was at the end of June. The notice is arriving in November. That gap is long enough for a copy to have been used.

Watch for new-account fraud, loan or SIM-swap attempts, and mail that quotes your business address and phone as if it came from a registrar or a bank. A message that claims to be DigiCert and asks for a fresh scan of a passport or a license is the follow-on this breach makes cheap. Open a ticket from the CertCentral or DigiCert account you already use. Drop the link in the unexpected letter.

Leave issued certificates in place. DigiCert says issuance and customer logins were not the system that was read. Change any password that was reused from a DigiCert account onto another service. Business email addresses left with the archive, and a password-reset wave is the obvious next mail. If the validation contact is a shared mailbox, tell the people who read it before they answer a lookalike.

File the November notice with the incident record, including the June 27 to July 2 window. If a later letter names your organization in the identity-document review, add that letter too. The certificates can stay. The scans of the people who requested them are already out.

This briefing relies on public reporting by BleepingComputer, on DigiCert’s customer notice, and on the incident report in Mozilla’s Bugzilla.